5.9
CVE-2026-34052
- EPSS 0.33%
- Veröffentlicht 03.04.2026 22:04:10
- Zuletzt bearbeitet 13.04.2026 17:44:00
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
LoginLTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service)
LTI JupyterHub Authenticator is a JupyterHub authenticator for LTI. Prior to version 1.6.3, the LTI 1.1 validator stores OAuth nonces in a class-level dictionary that grows without bounds. Nonces are added before signature validation, so an attacker with knowledge of a valid consumer key can send repeated requests with unique nonces to gradually exhaust server memory, causing a denial of service. This issue has been patched in version 1.6.3.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jupyter ≫ Lti Jupyterhub Authenticator Version < 1.6.3
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.33% | 0.244 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security-advisories@github.com | 5.9 | 2.2 | 3.6 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
|
CWE-401 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
CWE-770 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
https://github.com/jupyterhub/ltiauthenticator/security/advisories/GHSA-8mxq-7xr7-2fxj
https://github.com/jupyterhub/ltiauthenticator/releases/tag/1.6.3